Extracted

• • Target

    173dd802cff3c8108b468fadd399ac5917b7d4e3692dbae79210909d8f6a0672.exe

  • Size

    416KB

  • MD5

    3a61a18c09b40be78d90fe3fa0ea1ca6

  • SHA1

    aa73a8760611ea9259cb0a200224f638b608b931

  • SHA256

    173dd802cff3c8108b468fadd399ac5917b7d4e3692dbae79210909d8f6a0672

  • SHA512

    bcaa2529a710ac13fb5c02fed7422c9bcbb9b0705bb46a3b5f17fa73045588d9ef576648339721f6b2498349ce5cc06112b96171676b4058ea2717f832c90c36

  • SSDEEP

    6144:g+9dVYc7/0DIFVFMYk8LHFcrbXsCNytqZbMq+R1y9d268jrHi9QFonxnqq:P/0DcmYk8zFcetqZQ68noRIq

  Score

  10^/10

  salitybackdoordiscoveryupxevasiontrojan

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • Sality family

    sality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2